Systemd hardening is great, but each service needs its own bespoke config and that takes a bit of time and trial & error. Here's the override I've been using for Jellyfin: https://gist.github.com/radupotop/61d59052ff0a81cc5a32c92b3b...

Some references:

- https://docs.arbitrary.ch/security/systemd.html

- https://gist.github.com/ageis/f5595e59b1cddb1513d1b425a323db...